Perfmon alerts don't run scripts

[Guest William]

hi,

 

i have perfmon alerts config'd to monitor disk space, memory, and many other

counters. i have created a regular (non admin) user that the alert runs as.

all of the perfmon alerts start just fine and run appropriately UNTIL an

alert is fired and it has to execute a batch file with "cscript

sendemail.vbs ...." in it. i have even altered batch file to simply "echo

test > c:\scripts\test.txt" (without quotes) and that won't even work

the alert is never fired and of course i never receive alerts. :) user has

been granted logon locally rights in sec pol, and i assigned user the logon

as batch file rights in sec pol. i have also granted the builtin batch user

read/execute on the cmd.exe file in %systemroot%\system32 (KB867466).

 

the only way alert works is if i add user to loca local administrators group

which i cannot do. i even tried adding user to profile system performance

sec pol and to both perfmon local groups and that doesn't make a difference.

user has full control over the c:\scripts directory (where batch file and

sendemail.vbs script resides).

 

if i log on to box locally with user configured as run as in alert, i am

able to execute the batch file which executes vbsscript with no issue and

e-mail is sent.

 

the app log reports following event when it attempts to execute cmd

associated with alert:

Source: SysmonLog

Type: Warning

Event ID: 2038

User: N/A

Description: Unable to execute command " for the High Disk Activity alert.

The alert will continue as scheduled. The error code returned is in the

data.

 

Data (words): 00000005

 

 

any help appreciated getting this to work. since i have changed batch file

to something simple as echo piped to text file that still doesn't work so it

is something with permissions as stated in event above (00000005).

 

thank you.